UbuntuUpdates.org

Package "libcurl4-doc"

Name: libcurl4-doc

Description:

documentation for libcurl
Latest version: 8.18.0-1ubuntu2.7
Release: resolute (26.04)
Level: security
Repository: main
Head package: curl
Homepage: https://curl.se/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libcurl4-doc"

All arch deb package
APT INSTALL

Other versions of "libcurl4-doc" in Resolute

Repository Area Version
base main 8.18.0-1ubuntu2
updates main 8.18.0-1ubuntu2.7

Changelog

Version: 8.18.0-1ubuntu2.7 2026-09-24 17:07:34 UTC

curl (8.18.0-1ubuntu2.7) resolute-security; urgency=medium

  [ Charles Cochran ]
  * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.
    - debian/patches/CVE-2026-13608.patch: openldap: handle
      Curl_sasl_continue() returns better in lib/openldap.c.
    - CVE-2026-13608
  * SECURITY UPDATE: Use after free in HTTP/2 server push.
    - debian/patches/CVE-2026-18924.patch: make server push transfers
      inherit share from parent in lib/http2.c.
    - CVE-2026-18924
  * SECURITY UPDATE: Use after free in OpenSSL library context.
    - debian/patches/CVE-2026-80229.patch: avoid conn reuse if provider is
      used in lib/vtls/openssl.c.
    - CVE-2026-80229
  * SECURITY UPDATE: Public key pinning bypass.
    - debian/patches/CVE-2026-80230.patch: require server cert if public
      key pinned in lib/vtls/openssl.c.
    - CVE-2026-80230
  * SECURITY UPDATE: Cookie Secure attribute bypass in Set-Cookie.
    - debian/patches/CVE-2026-80255.patch: improve TAB handling in
      lib/cookie.c, tests/data/Makefile.am, tests/data/test2885.
    - CVE-2026-80255
  * SECURITY UPDATE: Cookie injection for public suffix domains.
    - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact
      PSL domain are host-only in lib/cookie.c, tests/data/Makefile.am,
      tests/data/test1136, tests/data/test2318, tests/data/test798.
    - CVE-2026-82209
  * SECURITY REGRESSION: CVE-2026-9080: upstream pt 2 needed (LP: #2167969)
    - debian/patches/CVE-2026-9080-post1.patch: multi_ev: refresh sock
      entry after remove callback in lib/multi_ev.c.

  [ Kyle Kernick ]
  * SECURITY REGRESSION: checksrc errors and failing test case for
    CVE-2026-8927 (LP #2167779)
    - debian/patches/CVE-2026-11856.patch: Use curlx_strdup to fix
      autopkgtests
    - debian/patches/CVE-2026-8458.patch: Wrap long lines and remove unused
      variable to fix autopkgtests
    - debian/patches/CVE-2026-8927.patch: Fix failing test

 -- Charles Cochran Fri, 18 Sep 2026 14:17:09 -0400
Source diff to previous version
2167969 Upstream update to CVE-2026-9080 fix missing in Resolute
2167779 Reverted security upload 8.20.0-2ubuntu4, broken checksrc and CVE-2026-8927 backport
CVE-2026-13608 A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptogra
CVE-2026-18924 A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-af
CVE-2026-80229 When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider con
CVE-2026-80230 When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL
CVE-2026-80255 A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes cur
CVE-2026-82209 When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domai
CVE-2026-9080 Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts
CVE-2026-8927 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentic
CVE-2026-11856 Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a diff
CVE-2026-8458 libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different

Version: 8.18.0-1ubuntu2.5 2026-09-08 19:07:45 UTC

curl (8.18.0-1ubuntu2.5) resolute-security; urgency=medium

  * SECURITY UPDATE: Authentication Bypass in connection reuse.
    - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in
      lib/ldap.c, ../urldata.h, lib/vssh/libssh.c, ../libssh2.c,
      lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../rustls.c,
      ../schannel.c, ../vtls.c, ../vtls_scache.c, ../vtls_scache.h,
      and ../wolfssl.c.
    - CVE-2026-8932

 -- Kyle Kernick Fri, 21 Aug 2026 12:55:56 -0600
Source diff to previous version
CVE-2026-8932 libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. li

Version: 8.18.0-1ubuntu2.4 2026-08-19 18:08:35 UTC
No changelog available yet.
Source diff to previous version

Version: 8.18.0-1ubuntu2.3 2026-07-09 21:08:33 UTC

  curl (8.18.0-1ubuntu2.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Use after free in curl_easy_reset.
    - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in
      include/curl/curl.h, lib/http2.c,
      lib/setopt.c, lib/url.c, and lib/urldata.h
    - CVE-2026-10536
  * SECURITY UPDATE: Denial of service in QUIC UDP.
    - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets
      and enforce an upper bound in
      lib/vquic/vquic.c
    - CVE-2026-11352
  * SECURITY UPDATE: Improper certificate validation in native_ca_store.
    - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to
      keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to
      calculate every easy transfer if a native CA store shall be used or
      not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c
    - CVE-2026-11564
  * SECURITY UPDATE: Memory exhaustion in ws.c
    - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless
      there is sufficient space left in the websocket send buffer in
      lib/ws.c.
    - CVE-2026-11586
  * SECURITY UPDATE: Improper validation in config2setopts.
    - debian/patches/CVE-2026-12064.patch: Use default protocol properly in
      src/config2setopts.c.
    - CVE-2026-12064

 -- Kyle Kernick <email address hidden> Mon, 06 Jul 2026 10:45:44 -0600
Source diff to previous version
CVE-2026-10536 A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CUR
CVE-2026-11352 An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client.
CVE-2026-11564 libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle th
CVE-2026-11586 By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a
CVE-2026-12064 When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl

Version: 8.18.0-1ubuntu2.2 2026-07-01 02:08:29 UTC

  curl (8.18.0-1ubuntu2.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Connection reuse for starttls protocols.
    - debian/patches/CVE-2026-8286.patch: When a connection is tested for
      reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),
      the SSL configuration must match the existing connection in lib/url.c
    - CVE-2026-8286
  * SECURITY UPDATE: Connection reuse in SASL.
    - debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in
      in lib/curl_sasl.c, lib/http_negotiate.c, lib/http_ntlm.c, lib/imap.c,
      lib/openldap.c, and lib/pop3.c
    - CVE-2026-8458
  * SECURITY UPDATE: Cookie injection in is_public_suffix.
    - debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking
      PSL in lib/cookie.c.
    - CVE-2026-8924
  * SECURITY UPDATE: Double-free in gsasl.
    - debian/patches/CVE-2026-8925.patch: Require libgasl 1.6.0 to handle
      NULL argument in lib/vauth/gsasl.c.
    - CVE-2026-8925
  * SECURITY UPDATE: Information disclosure in netrc.
    - debian/patches/CVE-2026-8926.patch: Do not return a password from
      parsenetrc() when the requested login did not match the credentials
      found for the matched machine in lib/netrc.c.
    - CVE-2026-8926
  * SECURITY UPDATE: Information disclosure in libcurl
    - debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as
      previous and flush state in lib/url.c and lib/urldata.h.
    - debian/patches/CVE-2026-9079.patch: Verify NULLed proxy credentials
      in lib/setopt.c.
    - debian/patches/CVE-2026-9545.patch: Hard fail when certificate
      verification fails in lib/vquic/curl_ngtcp2.c.
    - CVE-2026-8927
    - CVE-2026-9079
    - CVE-2026-9545
  * SECURITY UPDATE: Use-after-free in curl_easy_parse
    - debian/patches/CVE-2026-9080.patch: Introduce magic struct field to
      assert against NULL pointers in lib/multi_ev.c
    - CVE-2026-9080
  * SECURITY UPDATE: Man-in-the-middle in libcurl.
    - debian/patches/CVE-2026-9547.patch: Reject host key mismatches in
      in lib/vssh/libssh.c
    - CVE-2026-9547

 -- Kyle Kernick <email address hidden> Thu, 25 Jun 2026 15:11:42 -0600


About   -   Send Feedback to @ubuntu_updates